WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting

WordPress Hero Maps Premium plugin 2.2.1 and prior contains an unauthenticated reflected cross-site scripting vulnerability via the views/dashboard/index.php p parameter. id: CVE-2019-19134 info: name: WordPress Hero Maps Premium =2.2.2 or apply the vendor-provided patch to fix the XSS...

WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting

WordPress Hero Maps Pro 2.1.0 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

Member Hero <=1.0.9 - Remote Code Execution

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

CVE-2023-47218

CVE-2023-47218 CVE-2023-47218: Iniezione di comando non autenticata in QNAP QTS e QuTS Hero RISOLTO POC root@kitploit: POST /cgi-bin/quick/quick.cgi?func=switchos&todo=uploaffirmwareimage HTTP/1.1 Host: 192.168.86.42:8080 User-Agent: Mozilla Macintosh Accept: / Content-Length: 164 Content-Type:...

CVE-2023-22906

CVE-2023-22906 CVE-2023-22906 è una vulnerabilità critica che colpisce il dispositivo Hero Qubo Smart Doorbell con versione HCD0102V1.3820220125. Questo dispositivo consente l'accesso Telnet con privilegi di root per impostazione predefinita, senza richiedere una password. Questa vulnerabilità...

CF-Hero

CF-Hero CF-Hero Cos'è? • Funzionalità • Contesto • Installazione • Utilizzo • Esecuzione di cf-hero • ZoomEye Sponsor • Da fare Cos'è? CF-Hero è uno strumento completo di ricognizione sviluppato per scoprire i veri indirizzi IP delle applicazioni web protette da Cloudflare. Esegue la raccolta di...

CVE-2026-76789

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

CVE-2026-76789

CVE-2026-76789 is an unauthenticated stored XSS in the Slider Hero with Video Background, Animation WordPress plugin (versions before 9.1.3 ). Two request handlers — the Slider Type Change and Add-Slider handlers — lack proper authorisation and nonce checks , and a stored setting is not escaped b...

EUVD-2026-64223

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

CVE-2026-76789 Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

WordPress Slider Hero with Video Background, Animation plugin <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability

Authenticated Administrator+ SQL Injection via 'description' Slide Field Second-Order via Duplicate vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Slider Hero versions = 9.1.7...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582

Vulnerability details (CVE-2026-17582): The Slider Hero plugin for WordPress is affected up to version 9.1.7 by a second‑order SQL Injection in the qcld_sliderhero_duplicate() function. While slides are safely stored via prepared placeholders in qchero_save_image, triggering the 'heroduplicatesli...

CVE-2026-17582 Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582 Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

EUVD-2026-59902

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

PT-2026-73112

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld sliderhero duplicate function. Slide data description, title, btn, btn2, image link, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

Qnap QTS and QuTS hero Path Traversal (CVE-2026-24717)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2026-24716)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...